Media module apparatus and method for use in a network monitoring environment

• US 7,299,277 B1
• Filed: 01/11/2002
• Issued: 11/20/2007
• Est. Priority Date: 01/10/2002
• Status: Expired due to Term

• Current Assignee: Network General Technology
• Original Assignee: Network General Technology
• Inventors: Moran, Mike, Goral, Jack, Liubinskas, Tauras
• Primary Examiner(s): Jaroenchonwanit; Bunjob
• Assistant Examiner(s): DOAN, DUYEN MY
• Application Number:
  US10/045,820
• Time in Patent Office: 2,139 Days
• Field of Search: 709223-225, 709/232, 709/234, 709/240, 370230-235, 370/389, 370/412, 370/429, 370/229
• US Class Current: 709/224
• CPC Class Codes: H04L 41/0213 Standardised network management protocols, e.g. simple network management protocol [SNMP]
• CPC Class Codes: H04L 41/5022 by giving priorities, e.g. assigning classes of service
• CPC Class Codes: H04L 43/028 by filtering
• CPC Class Codes: H04L 43/12 Network monitoring probes
• CPC Class Codes: H04L 49/90 Buffering arrangements
• CPC Class Codes: H04L 49/901 using storage descriptor, e.g. read or write pointers
• CPC Class Codes: H04L 49/9031 Wraparound memory, e.g. overrun or underrun detection

Abstract

A probe apparatus, method and computer program product for application monitoring are provided. A data collection module collects data from a network segment. A flow processor coupled to the data collection module classifies the collected data into a plurality of flows. A capture system coupled to the flow processor filters and buffers the collected data. A main processor processes the filtered data.

Claims

1. A probe apparatus for application monitoring comprising:

(a) a data collection module for collecting data from a network segment;

(b) a flow processor coupled to the data collection module for classifying the collected data into a plurality of flows;

(c) a capture system coupled to the flow processor for filtering and buffering the collected data based on the collected data and the flow corresponding to the collected data, the capture system comprising a plurality of buffers allocated to the collected data, the capture system reallocating buffers if a number of priority flows changes; and

(d) a main processor for processing the filtered data based on the collected data and the flow corresponding to the filtered data;

wherein the data collection module prepends the data with descriptor information, wherein the descriptor information is used by the capture system to filter the collected data;

wherein the capture system includes a capture buffer and a focus buffer, wherein the capture system filters the collected data stored in the capture buffer, wherein the filtered data is sent to the focus buffer;

wherein the capture system captures the collected data in the capture buffer in at least one of a fill and stop mode, a wrap mode, a priority queuing mode and a non-priority queuing mode;

wherein in priority queuing mode the capture buffer is segmented into priority and non-priority queues, wherein the buffer space for each queue varies dynamically based on the arrival of data that meets priority criteria; and

wherein buffers are reallocated to the priority queue from the non-priority queue as the number of priority flows increases.

2. The probe apparatus as recited in claim 1, wherein buffers are reallocated to the non-priority queue from the priority queue as the number of priority flows decreases.

3. The probe apparatus as recited in claim 1, wherein the capture system selectively discards flows from the priority queue based on predetermined criteria.

4. The probe apparatus as recited in claim 1, wherein the main processor identifies a flow as being important, wherein the flow processor uses the identification as criteria for forwarding additional data from the identified flow to the main processor.

5. The probe apparatus as recited in claim 1, wherein at least a portion of the probe apparatus is implemented on a Field Programmable Gate Array (FPGA).

6. The probe apparatus as recited in claim 5, wherein the portion of the probe apparatus implemented on the FPGA includes dedicated FPGA engines for capture and filtering of the data.

7. A method for application monitoring, comprising:

(a) collecting data from a network segment;

(b) classifying the collected data into a plurality of flows;

(c) prepending the data with descriptor information wherein the descriptor information is used to filter the collected data;

(d) filtering and buffering the collected data based on the collected data and the flow corresponding to the collected data, the buffering being allocated to the collected data;

(e) storing the collected data in a capture buffer, filtering the collected data stored in the capture buffer and sending the filtered data to a focus buffer;

(f) capturing the collected data in the capture buffer in a priority queuing mode;

(g) segmenting the capture buffer into priority and non-priority queues in the priority queuing mode, wherein buffer space for each queue varies dynamically based on the arrival of data that meets priority criteria;

(h) reallocating buffers to the priority queue from the non-priority queue as the number of priority flows increases; and

(i) processing the filtered data based on the collected data and the flow corresponding to the collected data.

8. The method as recited in claim 7, further comprising reallocating buffers to the non-priority queue from the priority queue as the number of priority flows decreases.

9. The method as recited in claim 7, wherein the capture system selectively discards flows from the priority queue based on predetermined criteria.

10. The method as recited in claim 7, further comprising identifying a flow of data as being important, and using the identification as criteria for forwarding additional data from the identified flow for processing.

11. A probe apparatus for application monitoring, comprising:

(a) a data collection module for collecting data from a network segment;

(b) a flow processor coupled to the data collection module for classifying the collected data into a plurality of flows;

(c) a capture system coupled to the flow processor for filtering and buffering the collected data based on the collected data and the flow corresponding to the collected data; and

(d) a main processor for processing the filtered data based on the collected data and the flow corresponding to the collected data;

(e) wherein the data collection module prepends the data with descriptor information, wherein the descriptor information is used by the capture system to filter the collected data;

(f) wherein the capture system includes a capture buffer and a focus buffer, wherein the capture system filters the collected data stored in the capture buffer, wherein the filtered data is sent to the focus buffer;

(g) wherein the capture system captures the collected data in the capture buffer in at least one of a fill and stop mode, a wrap mode, a priority queuing mode, and a non-priority queuing mode;

(h) wherein in priority queuing mode the capture buffer is segmented into priority and non-priority queues, wherein the buffer space for each queue varies dynamically based on the arrival of data that meets priority criteria;

(i) wherein buffers are reallocated to the priority queue from the non-priority queue as the number of priority flows increases;

(j) wherein buffers are reallocated to the non-priority queue from the priority queue as the number of priority flows decreases;

(k) wherein the capture system selectively discards flows from the priority queue based on predetermined criteria including at least one of an amount of priority data exceeding a processing capability of the system, user specifications, and the flow matching a randomly selected identifier;

(l) wherein the main processor identifies a flow as being important, wherein the flow processor uses the identification as criteria for forwarding additional data from the identified flow to the main processor;

(m) wherein at least a portion of the probe apparatus is implemented on a Field Programmable Gate Array (FPGA);

(n) wherein the portion of the probe apparatus implemented on the FPGA includes dedicated FPGA engines for capture and filtering of the data.